MarkLogic Server CVE-2026-85959

The weakness is inherent to affected releases (MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7) and manifests wherever customers rely on audit logs to track authentication - i.e., it matters only in deployments with auditing enabled and used for security monitoring. The flaw provides no direct access on its own: realizing any harm requires a separate successful authentication (using legitimate or stolen credentials), so the limiting factor is that an attacker must already be able to authenticate, and the actual consequence is reduced detection/forensic capability rather than new access. There are no special configuration triggers to 'enable' the defect - it is a default behavior of the vulnerable versions - so remediation is upgrading to 12.1.0 / 11.3.7 or later.

This is a defensive/visibility weakness (CWE-778, Insufficient Logging), not a direct code-execution or data-exposure flaw. The vendor CVSS of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) rates it High by mapping the loss of reliable audit records to I:H; however, the I:H choice is debatable because the flaw does not let an attacker tamper with system data - it merely causes successful authentication events to be omitted from audit logs, undermining accountability rather than data integrity. No EPSS score, KEV listing, or POC was supplied in the input, so exploitation-likelihood signals are absent: no public exploit identified at time of analysis. Critically, this vulnerability cannot be 'exploited' to gain access on its own - it has no standalone attacker payoff and instead amplifies the impact and reduces the detectability of OTHER access (stolen credentials, insider misuse). Treat it as a monitoring/forensics gap to remediate on a normal patch cadence rather than an emergency: realistic priority is moderate, and the 7.5 rating overstates direct exploitability. Note the CVSS vector (AV:N/PR:N) describes the authentication path context, not an unauthenticated remote exploit of the logging defect itself - verify interpretation with the Progress advisory.

An attacker who obtains valid MarkLogic credentials (e.g., phished, reused, or insider) authenticates successfully to an affected server; because the successful authentication is not consistently written to the audit log, defenders and incident responders have no reliable record of the access. The gap lets credential misuse and unauthorized sessions proceed undetected during and after the fact. No public exploit code is required or identified - the weakness is passive and manifests on affected versions by default.